Should companies minimize their data intake?

As companies collect more customer data to power digital experiences and AI initiatives, they also expand the amount of sensitive information they’re responsible for protecting. In this IT Brew article, cybersecurity experts examine whether businesses should rethink how much personally identifiable information (PII) they collect and retain in the first place.

A recurring theme is that reducing risk starts with reducing unnecessary data. Rather than treating customer data as an asset to collect indefinitely, companies should evaluate whether each piece of information serves a clear business purpose or delivers meaningful value to the customer. The less sensitive data stored, the smaller the potential attack surface if a breach occurs.

SupportNinja CTO Ken Braatz argues that companies often collect far more PII than they actually need. He explains that organizations should carefully evaluate every data point they gather, questioning whether it’s essential to complete a transaction or improve the customer experience. SupportNinja reinforces this approach by using AI to remove PII from recorded interactions, reducing unnecessary exposure while preserving operational value.

As AI adoption accelerates, data governance becomes increasingly important. Companies that combine data minimization with strong security controls and thoughtful governance will be better positioned to reduce cyber risk, protect customer trust, and responsibly scale AI initiatives.